An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions.

CVE-2026-69107 is a missing-authorization flaw (CWE-862) in JFrog Artifactory's stash search and export functionality. An unauthenticated attacker can manipulate stash search results to inject attacker-controlled repository paths into session data, then abuse a path-traversal weakness in the export function to copy restricted artifact bytes to arbitrary filesystem paths — including the Tomcat web root, where they can be retrieved via a URL path-confusion trick between jf-router and Tomcat. The vulnerability affects Artifactory OSS and Enterprise self-managed editions prior to 7.146.8. When chained with CVE-2026-42018 (a trailing-slash auth bypass scored 7.5 HIGH that mints an anonymous JWT even when anonymous access is disabled), the result is a fully unauthenticated artifact-theft primitive.

JFrog scored this CVE a MEDIUM 5.9 with AC:H, reflecting the chain complexity and the read-only impact (C:H/I:N/A:N). That rating is defensible for a generic application server, but it materially understates the risk for Artifactory specifically. Artifactory is a *canonical supply-chain component* — it stores Docker images, internal npm/Maven/PyPI packages, Helm charts, and build artifacts that routinely embed secrets, proprietary code, and deployment credentials. Reading those artifacts is not a low-value information disclosure; it is a supply-chain reconnaissance event that enables downstream compromise. The vendor MEDIUM does not account for this role multiplier.

Why this verdict

• Role multiplier — supply-chain artifact store: Artifactory is listed in the high-value-role catalog under CI/CD + artifact stores and supply-chain registries. The blast radius of reading all artifacts is organization-wide IP theft and potential credential harvesting from embedded secrets. This floors the verdict at HIGH.
• Unauthenticated chain exists: CVE-2026-42018 (same fix version, same disclosure) removes the authentication barrier entirely. The combined chain requires zero credentials and zero user interaction, which is a decisive upgrade factor over what AC:H alone would suggest.
• Read-only impact caps at HIGH, not CRITICAL: The chain produces C:H/I:N/A:N — artifact theft, not artifact poisoning. There is no write primitive, so supply-chain *injection* (the CRITICAL-floor scenario) is not achievable through this chain alone.
• Low internet exposure provides friction but does not break the floor: ~116 public instances on Shodan is a small population, but most Artifactory exploitation risk comes from internal attackers or post-initial-access lateral movement, where network restrictions do not apply. The floor holds.

Why not higher?

The chain is read-only — it cannot write or poison artifacts, which means the supply-chain *injection* scenario (the CRITICAL floor trigger) is not reachable. The AC:H complexity and the requirement for a companion CVE (CVE-2026-42018) to complete the chain add real friction. No active exploitation or KEV listing exists to force an urgency override.

Why not lower?

Artifactory is a canonical high-value-role component storing build artifacts, container images, and packages that routinely embed credentials and proprietary code. Reading those artifacts is not a benign information disclosure — it is supply-chain reconnaissance enabling downstream compromise. The unauthenticated attack path (via the companion auth bypass) on a supply-chain component with fleet-scale blast radius makes MEDIUM indefensible regardless of the low Shodan count.

1. Place Artifactory behind authenticated reverse proxy or VPN immediately — The chain requires direct HTTP access to Artifactory endpoints. An authenticating reverse proxy (e.g., Nginx with mTLS, Cloudflare Access, or Zscaler ZPA) eliminates the unauthenticated attack surface entirely. Deploy within 30 days per the noisgate mitigation SLA for HIGH.
2. Enable and monitor audit logging for anonymous API calls — The chain produces anomalous anonymous-user activity on stash search and export APIs. Configure Artifactory access logs to alert on anonymous JWT usage against stash and export endpoints. This provides detection-in-depth while patching proceeds.
3. Harden filesystem permissions on Tomcat web root — The path-traversal export writes to the Tomcat web root. Making the web root read-only (via mount options, SELinux, or container read-only layers) blocks step 3 of the chain even if the earlier steps succeed.
4. Restrict export API access via Artifactory permission targets — Limit the export functionality to named admin users only. Remove export permissions from anonymous and low-privilege roles. This breaks the chain at step 3 even without the filesystem hardening.
5. Upgrade to Artifactory 7.146.8 or applicable backport — The definitive fix. Both CVE-2026-69107 and CVE-2026-42018 are resolved in 7.146.8. Plan upgrade within the 180-day noisgate remediation SLA for HIGH, but prioritize earlier given the supply-chain role.

Run this script on the Artifactory host (or any host with curl access to the Artifactory URL) as any user. Invoke with: bash check_cve_2026_69107.sh https://artifactory.example.com. No special privileges required — it only checks the version API.

#!/usr/bin/env bash
# check_cve_2026_69107.sh — Check JFrog Artifactory for CVE-2026-69107 exposure
# Usage: bash check_cve_2026_69107.sh <ARTIFACTORY_BASE_URL>
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

ARTIFACTORY_URL="${1:-}"
FIXED_MAJOR=7
FIXED_MINOR=146
FIXED_PATCH=8

if [[ -z "$ARTIFACTORY_URL" ]]; then
  echo "Usage: $0 <ARTIFACTORY_BASE_URL>"
  echo "Example: $0 https://artifactory.example.com"
  exit 2
fi

# Strip trailing slash
ARTIFACTORY_URL="${ARTIFACTORY_URL%/}"

# Query the system version endpoint
VERSION_JSON=$(curl -sf --max-time 10 "${ARTIFACTORY_URL}/api/system/version" 2>/dev/null) || {
  echo "UNKNOWN — Could not reach ${ARTIFACTORY_URL}/api/system/version"
  exit 2
}

VERSION=$(echo "$VERSION_JSON" | grep -oP '"version"\s*:\s*"\K[0-9.]+' | head -1)

if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN — Could not parse version from API response"
  exit 2
fi

echo "Detected Artifactory version: $VERSION"

# Parse major.minor.patch
IFS='.' read -r V_MAJOR V_MINOR V_PATCH <<< "$VERSION"
V_MAJOR=${V_MAJOR:-0}
V_MINOR=${V_MINOR:-0}
V_PATCH=${V_PATCH:-0}

# Compare versions
if (( V_MAJOR > FIXED_MAJOR )); then
  echo "PATCHED — Version $VERSION is above the fixed version $FIXED_MAJOR.$FIXED_MINOR.$FIXED_PATCH"
  exit 0
elif (( V_MAJOR == FIXED_MAJOR )); then
  if (( V_MINOR > FIXED_MINOR )); then
    echo "PATCHED — Version $VERSION is above the fixed version $FIXED_MAJOR.$FIXED_MINOR.$FIXED_PATCH"
    exit 0
  elif (( V_MINOR == FIXED_MINOR )); then
    if (( V_PATCH >= FIXED_PATCH )); then
      echo "PATCHED — Version $VERSION is at or above the fixed version $FIXED_MAJOR.$FIXED_MINOR.$FIXED_PATCH"
      exit 0
    fi
  fi
fi

echo "VULNERABLE — Version $VERSION is below the fixed version $FIXED_MAJOR.$FIXED_MINOR.$FIXED_PATCH"
echo "Upgrade to Artifactory >= 7.146.8 to remediate CVE-2026-69107 and CVE-2026-42018"
exit 1

Sources

1. Tenable CVE Entry
2. NetSPI Technical Write-Up (hendryadrian.com)
3. JFrog Security Advisories
4. Stack.watch — Artifactory 2026 CVEs
5. CVE-2026-42018 (VulDB)
6. The Hacker News — JFrog/OpenAI Incident (separate CVEs)
7. Artifactory Self-Managed Releases